dcrat | e297203dfba8fae21f135b84577e5ca2bab763ce31dd4870a6675ce4bf4b4438

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2023, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b2d4fcde79ec18965ade78318c38c4c.exe
Size

3.5MB
MD5

2b2d4fcde79ec18965ade78318c38c4c
SHA1

6117aa4ee5f83046ba23398deeeb892b1bb22bab
SHA256

e297203dfba8fae21f135b84577e5ca2bab763ce31dd4870a6675ce4bf4b4438
SHA512

bb3d45a350c1c8a7ad79251872d2d163249c65b3953d2031f817322972915d75c5a839599ad0a37251bee5346ab1ff3fdfde47b341255c02f0c9f51c3b0325b8
SSDEEP

98304:vJGVP6249vx6nXmtxhwv1CT86mtaxOl7uss/31N3H:vUVoVxQX2xh2088xMk/lh

Score

10^/10

dcrat orcus новый тег infostealer rat spyware stealer

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

128.59.46.185:20954

Mutex

sudo_t5h71vhdjlc15uv100unb79v0m48rb0o

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%appdata%\securepipeasync\lineline.exe
reconnect_delay
10000
registry_keyname
Sudik
taskscheduler_taskname
sudik
watchdog_path
AppData\aga.exe

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 8 IoCs

resource	yara_rule
behavioral2/files/0x000c000000022fae-145.dat	family_orcus
behavioral2/files/0x000c000000022fae-151.dat	family_orcus
behavioral2/files/0x000c000000022fae-152.dat	family_orcus
behavioral2/files/0x00060000000230bc-175.dat	family_orcus
behavioral2/files/0x00060000000230bc-179.dat	family_orcus
behavioral2/files/0x00060000000230bc-181.dat	family_orcus
behavioral2/files/0x00060000000230bc-234.dat	family_orcus
behavioral2/files/0x00060000000230bc-236.dat	family_orcus

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000230ac-137.dat	dcrat
behavioral2/files/0x00070000000230ac-140.dat	dcrat
behavioral2/files/0x00070000000230ac-154.dat	dcrat
behavioral2/files/0x00060000000230b9-185.dat	dcrat
behavioral2/files/0x00060000000230b9-186.dat	dcrat
behavioral2/memory/3396-187-0x0000000000720000-0x00000000007C4000-memory.dmp	dcrat

Orcurs Rat Executable 9 IoCs

resource	yara_rule
behavioral2/files/0x000c000000022fae-145.dat	orcus
behavioral2/files/0x000c000000022fae-151.dat	orcus
behavioral2/files/0x000c000000022fae-152.dat	orcus
behavioral2/memory/4656-153-0x0000018B7CDD0000-0x0000018B7D0E0000-memory.dmp	orcus
behavioral2/files/0x00060000000230bc-175.dat	orcus
behavioral2/files/0x00060000000230bc-179.dat	orcus
behavioral2/files/0x00060000000230bc-181.dat	orcus
behavioral2/files/0x00060000000230bc-234.dat	orcus
behavioral2/files/0x00060000000230bc-236.dat	orcus

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	2b2d4fcde79ec18965ade78318c38c4c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	lineline.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 7 IoCs

pid	Process
3916	DCRatBuild.exe
4656	lineline.exe
3504	lineline.exe
2364	lineline.exe
3396	hyperReview.exe
4808	lineline.exe
2296	lineline.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	DCRatBuild.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4656	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe
3504	lineline.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	lineline.exe
Token: SeDebugPrivilege	3504	lineline.exe
Token: SeDebugPrivilege	3396	hyperReview.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3916	2356	2b2d4fcde79ec18965ade78318c38c4c.exe	86
PID 2356 wrote to memory of 3916	2356	2b2d4fcde79ec18965ade78318c38c4c.exe	86
PID 2356 wrote to memory of 3916	2356	2b2d4fcde79ec18965ade78318c38c4c.exe	86
PID 2356 wrote to memory of 4656	2356	2b2d4fcde79ec18965ade78318c38c4c.exe	87
PID 2356 wrote to memory of 4656	2356	2b2d4fcde79ec18965ade78318c38c4c.exe	87
PID 3916 wrote to memory of 2532	3916	DCRatBuild.exe	88
PID 3916 wrote to memory of 2532	3916	DCRatBuild.exe	88
PID 3916 wrote to memory of 2532	3916	DCRatBuild.exe	88
PID 4656 wrote to memory of 3504	4656	lineline.exe	89
PID 4656 wrote to memory of 3504	4656	lineline.exe	89
PID 3504 wrote to memory of 3096	3504	lineline.exe	91
PID 3504 wrote to memory of 3096	3504	lineline.exe	91
PID 3504 wrote to memory of 3096	3504	lineline.exe	91
PID 3504 wrote to memory of 3096	3504	lineline.exe	91
PID 3504 wrote to memory of 4564	3504	lineline.exe	92
PID 3504 wrote to memory of 4564	3504	lineline.exe	92
PID 3504 wrote to memory of 4564	3504	lineline.exe	92
PID 3504 wrote to memory of 4564	3504	lineline.exe	92
PID 3504 wrote to memory of 388	3504	lineline.exe	93
PID 3504 wrote to memory of 388	3504	lineline.exe	93
PID 3504 wrote to memory of 388	3504	lineline.exe	93
PID 3504 wrote to memory of 388	3504	lineline.exe	93
PID 3504 wrote to memory of 4920	3504	lineline.exe	94
PID 3504 wrote to memory of 4920	3504	lineline.exe	94
PID 3504 wrote to memory of 4920	3504	lineline.exe	94
PID 3504 wrote to memory of 4920	3504	lineline.exe	94
PID 3504 wrote to memory of 4576	3504	lineline.exe	95
PID 3504 wrote to memory of 4576	3504	lineline.exe	95
PID 3504 wrote to memory of 4576	3504	lineline.exe	95
PID 3504 wrote to memory of 4576	3504	lineline.exe	95
PID 3504 wrote to memory of 4976	3504	lineline.exe	96
PID 3504 wrote to memory of 4976	3504	lineline.exe	96
PID 3504 wrote to memory of 4976	3504	lineline.exe	96
PID 3504 wrote to memory of 4976	3504	lineline.exe	96
PID 3504 wrote to memory of 712	3504	lineline.exe	97
PID 3504 wrote to memory of 712	3504	lineline.exe	97
PID 3504 wrote to memory of 712	3504	lineline.exe	97
PID 3504 wrote to memory of 712	3504	lineline.exe	97
PID 3504 wrote to memory of 1536	3504	lineline.exe	98
PID 3504 wrote to memory of 1536	3504	lineline.exe	98
PID 3504 wrote to memory of 1536	3504	lineline.exe	98
PID 3504 wrote to memory of 1536	3504	lineline.exe	98
PID 3504 wrote to memory of 1012	3504	lineline.exe	99
PID 3504 wrote to memory of 1012	3504	lineline.exe	99
PID 3504 wrote to memory of 1012	3504	lineline.exe	99
PID 3504 wrote to memory of 1012	3504	lineline.exe	99
PID 3504 wrote to memory of 3156	3504	lineline.exe	100
PID 3504 wrote to memory of 3156	3504	lineline.exe	100
PID 3504 wrote to memory of 3156	3504	lineline.exe	100
PID 3504 wrote to memory of 3156	3504	lineline.exe	100
PID 3504 wrote to memory of 652	3504	lineline.exe	101
PID 3504 wrote to memory of 652	3504	lineline.exe	101
PID 3504 wrote to memory of 652	3504	lineline.exe	101
PID 3504 wrote to memory of 652	3504	lineline.exe	101
PID 3504 wrote to memory of 1436	3504	lineline.exe	104
PID 3504 wrote to memory of 1436	3504	lineline.exe	104
PID 3504 wrote to memory of 1436	3504	lineline.exe	104
PID 3504 wrote to memory of 1436	3504	lineline.exe	104
PID 3504 wrote to memory of 4668	3504	lineline.exe	105
PID 3504 wrote to memory of 4668	3504	lineline.exe	105
PID 3504 wrote to memory of 4668	3504	lineline.exe	105
PID 3504 wrote to memory of 4668	3504	lineline.exe	105
PID 3504 wrote to memory of 696	3504	lineline.exe	106
PID 3504 wrote to memory of 696	3504	lineline.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2b2d4fcde79ec18965ade78318c38c4c.exe
"C:\Users\Admin\AppData\Local\Temp\2b2d4fcde79ec18965ade78318c38c4c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\portFontruntimesvc\IFs7PxNlf0FukhYTS68xpV.vbe"
    3⤵
    - Checks computer location settings
    PID:2532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\portFontruntimesvc\MDelSg1gMf2sbupZ4DcoQydnq.bat" "
      4⤵
      PID:4556
    - - C:\portFontruntimesvc\hyperReview.exe
        
        "C:\portFontruntimesvc\hyperReview.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
- C:\Users\Admin\AppData\Local\Temp\lineline.exe
  "C:\Users\Admin\AppData\Local\Temp\lineline.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe
    "C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:3096
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4564
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:388
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4576
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4976
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:712
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:1536
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:1012
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:3156
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:652
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:1436
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:4668
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:4412
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:2420
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:4996
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:1572
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:4844
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:3928
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:4644
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:5008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:212
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:1356
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:2636
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4404
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4580
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:1152
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4916
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:3856
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4264
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:5068
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4040
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4060
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:4008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:3588
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:5100
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:1396
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:1160
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:1288
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:4492
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:4436
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:2200
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:4820
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      4⤵
      PID:960
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:4672
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:3896
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:3948
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:4908
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:2780

C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe
1⤵
- Executes dropped EXE
PID:2364

C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe
1⤵
- Executes dropped EXE
PID:4808

C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe
1⤵
- Executes dropped EXE
PID:2296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lineline.exe.log

Filesize
1KB

MD5
9be3069b2cf9222dde6c28dd9180a35a

SHA1
14b76614ed5c94c513b10ada5bd642e888fc1231

SHA256
5e4c38466764be178ea21ba3149d0580d25d035b57e081b3abb9c06a19cfd67a

SHA512
043256f38c20d8765ddf2f1d5912249bfbb017c0b630d24d9e4894f4a759dec66bf0ffaf878ac69e9dfd6db7ec5e090dd69de2333d83299ef43888c394398885

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
940KB

MD5
35358d4b383f19ddbfff815b641a86f4

SHA1
6be51752e0192aeb013c095fc58fd974ad9f8071

SHA256
f6ff85c92c4d439d812ac91063809398fdaf93367df696c09a80c6779f5e3ad8

SHA512
77c1e20631b472c1edcd653d9e4ad2f3ffa217b38b1a5c297fcbdda33a39011480491b7f813e6fa8677f6e3d3f7ef2b424f236814ad5c169c4ca80d7bc7113a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
940KB

MD5
35358d4b383f19ddbfff815b641a86f4

SHA1
6be51752e0192aeb013c095fc58fd974ad9f8071

SHA256
f6ff85c92c4d439d812ac91063809398fdaf93367df696c09a80c6779f5e3ad8

SHA512
77c1e20631b472c1edcd653d9e4ad2f3ffa217b38b1a5c297fcbdda33a39011480491b7f813e6fa8677f6e3d3f7ef2b424f236814ad5c169c4ca80d7bc7113a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
940KB

MD5
35358d4b383f19ddbfff815b641a86f4

SHA1
6be51752e0192aeb013c095fc58fd974ad9f8071

SHA256
f6ff85c92c4d439d812ac91063809398fdaf93367df696c09a80c6779f5e3ad8

SHA512
77c1e20631b472c1edcd653d9e4ad2f3ffa217b38b1a5c297fcbdda33a39011480491b7f813e6fa8677f6e3d3f7ef2b424f236814ad5c169c4ca80d7bc7113a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lineline.exe

Filesize
3.1MB

MD5
c947802e4ff7646d3dcfa28fa3a9f47b

SHA1
7d2b692d73ec80ab9c32480bf0a728438cc2862f

SHA256
d2a76383575f395bb84b0df4a5a00da8882bfe6f4f0efee14abf6831ff35631b

SHA512
bc86c4261a19db626d92785a91fa17fc6dcab6b84c729b19ca95827133dd81636f0ab9ec24dc824c31b207d6b42ebfd81383c0c9112c1672aa50a1f3cfa78593

Download Submit
C:\Users\Admin\AppData\Local\Temp\lineline.exe

Filesize
3.1MB

MD5
c947802e4ff7646d3dcfa28fa3a9f47b

SHA1
7d2b692d73ec80ab9c32480bf0a728438cc2862f

SHA256
d2a76383575f395bb84b0df4a5a00da8882bfe6f4f0efee14abf6831ff35631b

SHA512
bc86c4261a19db626d92785a91fa17fc6dcab6b84c729b19ca95827133dd81636f0ab9ec24dc824c31b207d6b42ebfd81383c0c9112c1672aa50a1f3cfa78593

Download Submit
C:\Users\Admin\AppData\Local\Temp\lineline.exe

Filesize
3.1MB

MD5
c947802e4ff7646d3dcfa28fa3a9f47b

SHA1
7d2b692d73ec80ab9c32480bf0a728438cc2862f

SHA256
d2a76383575f395bb84b0df4a5a00da8882bfe6f4f0efee14abf6831ff35631b

SHA512
bc86c4261a19db626d92785a91fa17fc6dcab6b84c729b19ca95827133dd81636f0ab9ec24dc824c31b207d6b42ebfd81383c0c9112c1672aa50a1f3cfa78593

Download Submit
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe

Filesize
3.1MB

MD5
c947802e4ff7646d3dcfa28fa3a9f47b

SHA1
7d2b692d73ec80ab9c32480bf0a728438cc2862f

SHA256
d2a76383575f395bb84b0df4a5a00da8882bfe6f4f0efee14abf6831ff35631b

SHA512
bc86c4261a19db626d92785a91fa17fc6dcab6b84c729b19ca95827133dd81636f0ab9ec24dc824c31b207d6b42ebfd81383c0c9112c1672aa50a1f3cfa78593

Download Submit
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe

Filesize
3.1MB

MD5
c947802e4ff7646d3dcfa28fa3a9f47b

SHA1
7d2b692d73ec80ab9c32480bf0a728438cc2862f

SHA256
d2a76383575f395bb84b0df4a5a00da8882bfe6f4f0efee14abf6831ff35631b

SHA512
bc86c4261a19db626d92785a91fa17fc6dcab6b84c729b19ca95827133dd81636f0ab9ec24dc824c31b207d6b42ebfd81383c0c9112c1672aa50a1f3cfa78593

Download Submit
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe

Filesize
3.1MB

MD5
c947802e4ff7646d3dcfa28fa3a9f47b

SHA1
7d2b692d73ec80ab9c32480bf0a728438cc2862f

SHA256
d2a76383575f395bb84b0df4a5a00da8882bfe6f4f0efee14abf6831ff35631b

SHA512
bc86c4261a19db626d92785a91fa17fc6dcab6b84c729b19ca95827133dd81636f0ab9ec24dc824c31b207d6b42ebfd81383c0c9112c1672aa50a1f3cfa78593

Download Submit
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe

Filesize
3.1MB

MD5
c947802e4ff7646d3dcfa28fa3a9f47b

SHA1
7d2b692d73ec80ab9c32480bf0a728438cc2862f

SHA256
d2a76383575f395bb84b0df4a5a00da8882bfe6f4f0efee14abf6831ff35631b

SHA512
bc86c4261a19db626d92785a91fa17fc6dcab6b84c729b19ca95827133dd81636f0ab9ec24dc824c31b207d6b42ebfd81383c0c9112c1672aa50a1f3cfa78593

Download Submit
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe

Filesize
3.1MB

MD5
c947802e4ff7646d3dcfa28fa3a9f47b

SHA1
7d2b692d73ec80ab9c32480bf0a728438cc2862f

SHA256
d2a76383575f395bb84b0df4a5a00da8882bfe6f4f0efee14abf6831ff35631b

SHA512
bc86c4261a19db626d92785a91fa17fc6dcab6b84c729b19ca95827133dd81636f0ab9ec24dc824c31b207d6b42ebfd81383c0c9112c1672aa50a1f3cfa78593

Download Submit
C:\Users\Admin\AppData\Roaming\securepipeasync\lineline.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\portFontruntimesvc\IFs7PxNlf0FukhYTS68xpV.vbe

Filesize
220B

MD5
696dd36e43dfabcb46c5d1a01d83e074

SHA1
ccd0630199c3f2b8069df5d6c60143d4667f1bca

SHA256
8b79645b9b1edfcca61d94bc484a34e97acd457c523ffdc6302f2c8d9f516890

SHA512
f2f8234b5ad627c6cc9a67b9ed60fc752f0f871fe29835a7e67ecfd0925fa8c012b91345e6e2847cfff82c384a3c70e555ada6187ceecfc9383bbfa75e271ecf

Download Submit
C:\portFontruntimesvc\MDelSg1gMf2sbupZ4DcoQydnq.bat

Filesize
39B

MD5
8d2aa3c1f34c8d66ebe1fe33d1be720c

SHA1
6c2eee861d06a0f2213c879e55117ad49810060b

SHA256
adfa34a0415a3b8a9eed4bb4bcdd7f8ef8c9619b2ed1cc7efd28dded503be2bf

SHA512
9e3635bbd28459ae4aea66cab7f320b870d0aa9e70908f149e139c8d868f9bcc208be595b696b00096c90a6de039a53e757db8d55d7bdd381401577c45b3197c

Download Submit
C:\portFontruntimesvc\hyperReview.exe

Filesize
631KB

MD5
fff99ff34acdaff6fc588d3d9464a6bf

SHA1
42d0449b6cfc9e670ef47fe88b0d564402faae85

SHA256
e6577e298a5e589713417975f6dd31d24ae166244e7131a57d6a74c9e9645869

SHA512
74d989e8a1f632074ccb07f200568ebcc9261464dfc60aa57d070c9fb5329bfd641b0d5bba3bfa2cdc7f7e119376535b16ed9ee7da6392617e1083747713e8aa

Download Submit
C:\portFontruntimesvc\hyperReview.exe

Filesize
631KB

MD5
fff99ff34acdaff6fc588d3d9464a6bf

SHA1
42d0449b6cfc9e670ef47fe88b0d564402faae85

SHA256
e6577e298a5e589713417975f6dd31d24ae166244e7131a57d6a74c9e9645869

SHA512
74d989e8a1f632074ccb07f200568ebcc9261464dfc60aa57d070c9fb5329bfd641b0d5bba3bfa2cdc7f7e119376535b16ed9ee7da6392617e1083747713e8aa

Download Submit
memory/2296-237-0x000001D7B8150000-0x000001D7B8160000-memory.dmp

Filesize
64KB

Download
memory/2364-182-0x000001ADABED0000-0x000001ADABEE0000-memory.dmp

Filesize
64KB

Download
memory/3396-191-0x000000001BA40000-0x000000001BA90000-memory.dmp

Filesize
320KB

Download
memory/3396-188-0x000000001B490000-0x000000001B4A0000-memory.dmp

Filesize
64KB

Download
memory/3396-187-0x0000000000720000-0x00000000007C4000-memory.dmp

Filesize
656KB

Download
memory/3396-233-0x000000001B490000-0x000000001B4A0000-memory.dmp

Filesize
64KB

Download
memory/3504-189-0x000002B2ADF70000-0x000002B2ADF82000-memory.dmp

Filesize
72KB

Download
memory/3504-190-0x000002B2ADFD0000-0x000002B2AE00C000-memory.dmp

Filesize
240KB

Download
memory/3504-192-0x000002B2AE120000-0x000002B2AE22A000-memory.dmp

Filesize
1.0MB

Download
memory/3504-193-0x000002B3AF400000-0x000002B3AF5C2000-memory.dmp

Filesize
1.8MB

Download
memory/3504-194-0x000002B2946F0000-0x000002B294700000-memory.dmp

Filesize
64KB

Download
memory/3504-180-0x000002B2946F0000-0x000002B294700000-memory.dmp

Filesize
64KB

Download
memory/4656-155-0x0000018B7EED0000-0x0000018B7EEE0000-memory.dmp

Filesize
64KB

Download
memory/4656-153-0x0000018B7CDD0000-0x0000018B7D0E0000-memory.dmp

Filesize
3.1MB

Download
memory/4808-235-0x00000236A3BE0000-0x00000236A3BF0000-memory.dmp

Filesize
64KB

Download